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COMSEC 1-2/150 84. 9216/2 

5 October 1984JJ2I 


MEMORANDUM FOR THE DIRECTOR OF CENTRAL INTELLIGENCE 

SUBJECT: National Telecommunications and Information 

Systems Security Committee (NTISSC) Representation 


STAT 

STAT 


STAT 


1. The National Security Decision Directive (NSDD) 

Nxamber 145 signed into effect 17 September 1984 by the President, 
provides for your representative's participation in the work 
of the National Telecommunications and Information Systems 
Security Committee (NTISSC) . Your representative should have 
a Top Secret clearance and should be prepared to personally 
attend Committee meetings . There will be no provisions for 
alternates . 


2 . Th e Executive Secretary of the NTISSC is^ 

telephone (301) 688-6811. Please provide him the 
name, mailing address and phone number (s) for your representative 
not later than 19 October 1984. 

3. Enclosed are proposed operating procedures for the 
NTISSC and its two permanent subcommittees. These will be 
adopted at the first NTISSC meeting scheduled for 8 November 1984, 
from 0900-1100, in the Secretary of Defense's Conference Room, 
room 3E912, the Pentagon. An agenda will be forwarded to your 
representative prior to the meeting. In addition to the 
information requested above, comments /concurrence in the proposed 
procedures and suggested agenda topics should a lso be forwarded 

to the Executive Secretary by 19 October 1984. 

mailing address is: National Security Agency, Attn: Executive 
Secretary, NTISSC/S08, Fort George G. Meade, Md. 20755-6000. 

4. I wish to take this opportunity to welcome in advance 
your representative to the. Committee and to participation in 
Committee activities. 


Regards , 



DONALD C. LATHAM 
Chairman , 

National Telecommunications and 
Information Systems Security Committee 


3 Ends : 
a/s 



^ ~l I ^ 
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NTISS Directive No. 900 
Date : 


GOVERNING PROCEDURES 
of the 

NATIONAL TELECOMMUNICATIONS AND INFORMATION STSTBIS 

SECURITY COMMITTEE 


Section I - Establishment and Purpose 

1. National Security Decision Directive (NSDD) 145, 
entitled "National Policy on Telecommunications and Automated 
Information Systems Security," dated September 17, 1984, 
establishes initial national objectives, policies, and 

an organizational structure to guide the conduct of national 
activities directed toward safeguarding systems which process or 
communicate sensitive information from hostile exploitation, 
establishes a mechanism for policy development, and assigns 
responsibilities for implementation. The Directive, Section 3, 
establishes a senior level steering group, an interagency group 
at the operating level, an executive agent, and a national 
manager to implement these objectives and policies. 

2. The purpose of this National Telecommunications and 
Informations Systems Security (NTISS) Directive is to establish 
the operating procedures governing the National Telecommuni- 
cations and Information Systems Security Committee, and 
subordinate bodies as well as delinate the interrelationships 
between and among the Committee and the Systems Security 
Steering Group, the Executive Agent, and the National Manager. 
NSDD-145, Section 4, creates and specifies one of the 
responsibilities of the Systems Security Steering Group (the 
"Steering Group"), will be to monitor the activities of the 
operating level National Telecommunications and Information 
Systems Security Committee (the "Committee") and provide 
guidance for its activities. 

Section II - Membership and Officers 

1. The National Telecommunications and Information Systems 
Security Committee (NTISSC) shall be chaired by the Assistant 
Secretary of Defense for Command, Control, Communications and 
Intelligence, ASD(C3I), and be composed of those Federal 
departments, agencies, or entities ("organizations") designated 
in NSDD-145, Section 5, and listed in this Directive as Appendix 
A. 


2. Each participating NTISSC member organization shall 
designate a "representative" to serve on and attend to Committee 
functions, meetings, or activities. 
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3. Other Federal organizations may be invited or 
designated, as the Committee recommends, by the Chair of the 
NTISSC to participate on an observer member basis. Such 
organizations with observer status may attend meetings and 
ps^^ticipate in Committee activities. 

All organizations designated as members of the 
Coaaittee, or invited to participate, shall accredit in writing 
Chair, their representatives or observers for ^ 

participation in the Committee. 


5. Personnel participating in the activities of the 

subordinate bodies, shall possess, as a minimum, 
a TOP SECRET security clearance. Written verification of 
security clearances shall be submitted to the Executive 
Secretary. 


Section III - Subordinate Bodies of the NTISSC 


1. The Committee shall have two 
bodies: a Subcommittee on Telecommun 
Subcommittee on Automated Information 
subcommittees shall interact closely 
concerning implementation of protecti 
and coordinate both areas as appropri 
subcommittees shall be comprised of r 
same organizations which comprise the 


permanent subordinate 
ications Security and a 
Systems Security. The 
and any recommendations 
ve measures shall combine 
ate. The permanent 
epresentatives from the 
Committee. 


2. The Committee may establish such other permanent and 
temporary subordinated bodies as necesary to discharge its 
activities and responsibilities. These bodies may be composed 

oil other individuals as the Committee shall 

select, and must be established by majority vote of the 
Committee . 


3. Subordinate body procedures and specific 
responsibilities shall be governed by separate charter. 

4. The Committee or the Chair, as appropriate, shall 
provide guidance to ensure the effective functioning of 
subordinate bodies. 


5. The Committee shall have a permanent Executive 
Secretariat composed of personnel of the National Security 

other personnel from organizations represented 
on the Committee as are requested by the Chair. 


Section IV - Activities and Responsibilities 


1. The activities and responsibilities of 
directed by NSDD-145. In order to execute these 
responsibilities the NTISSC shall; 


the NTISSC are 
activities and 
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develop, through attendance and participation in 
meetings or other activities, operating policies, objectives, 
and priorities on matters of telecommunications security and 
automated information systems security; 

. provide telecommunications and automated 

sptems security guidance to the departments and 
agencies of the government; 

™?*’itor and provide guidance and direction to the 
operating level subordinate bodies of the Committee. 

liaison with the National Communications 
Systems Committee of Principals and such other departments and 
agencies as from time to time are required to accomplish the 
objectives and policies set forth in NSDD-145. 

2. The Committee representatives shall: 

a. be fully empowered to act on behalf of their 
respective organizations on Committee matters; 

r. -i... as their organizations' point of contact for 

Committee and other matters related to the NTISSC; 

*?*, Provide complete and timely staffing of Committee 
actions within their organizations; committee 

rnmmi*-*. * Pf^vide, through attendance and participation in 
Co^ittee meetings, or other functions, their respectiv^ 
organizations positions on matters before the Committee; 

bodies 

ln'sdSord^na?fbodles^”^“^"" ^Sanitations serving 

reports, comments, or recommendations to 
the Committee, as required, through the Executive Secretary; 

ar^r^r i snsure that their respective organizations are 

thrcommi?Le?"'"'^ matters and other activities related to 

info^^°d ^f responsibility to^'Lep'^the^Lecutiie^gent^' 


meetings ; 


a. convene, preside over, and adjourn Committee 


r#br>r,r<-c: receive from and distribute to the Committee 

Sec?etary°°"^^" recommendations through the Executive 
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c. endorse, sign, or otherwise certify actions of the 
Committee; and 

d. provide, through the Executive Secretary, the 
necessary support for Committee activities, including the timely 
dissemination of meeting announcements, proposed agendas, 
current membership rosters, and minutes of Committee meetings. 

4 . The Executive Secretary shall; 

a. assist and provide support to the National Manager 
as Executive Secretary to the Systems Security Steering Group; 

b. provide administrative support to the Committee and 
maintain official records of Committee meetings and other 
activities, including the assignment of serials for documents 
submitted to the Committee for consideration; 

c. distribute correspondence to the Chair and 
representatives of the Committee, the Executive Agent, the 
National Manager, or other government organizations, as 
appropriate; 

d. establish and maintain a national system for 
promulgating the operating policies, directives, guidance, or 
other issuances, which may be required pursuant to NSDD-145 or 
as the Committee or the Chair so require; and 

e. maintain a current roster of the names and security 
clearances of all participants in the Committee and subordinate 
bodies, either permanent or temporary. 

5. The NSA shall provide facilities and support to the 
Executive Secretariat as required and other organizations 
represented on the Committee shall provide facilities and 
support as requested by the Chair, through the Executive 
Secretary. 


Section V - Meetings 

1. The Chair of the Committee shall not convene a meeting 
unless a quorum is present. A quorum shall constitute the 
presence of one more than one half of the representatives. 

2. The Committee shall meet at the call of the Chair or. 

Chair by a majority of its representatives. 
The Committee should meet at least once each calendar quarter, 
however, a minimum of two Committee meetings shall be convened 
each calendar year. At the final meeting each calendar year, 
the Committee shall establish a tentative schedule of meetings 
for the forthcoming year. 
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t-r. Committee meetings will be submitted 

the Executive Secretary and all timely 
submitted agenda items shall be included on the agenda All 
agenda items will be taken in th6 normal order of business of 

which proposed, unless withdrawn by the sponsor 
m! ‘disposed of by vote of the representatives at the 
Executive Secretary shall distribute supporting 
^ agenda Items for review by the membership prior^to 
meetings provided that such material is submitted to the 
Executive Secretary sufficiently in advance of the meeting. 

4. Subordinate bodies shall meet at the call of their 
respective Chairs or as established by Charter as necessary to 
accomplish assigned tasks. ^ 

Except in emergency circumstances, notice of scheduled 
Committee meetings and proposed agendas shall be provided by the 
Secretary ten calendar days prior to the meetinq date 
pfruJtpLts.'""'"'’"" reguire%pproval by thr^e^tlng 

^ho TP®* Committee meetings shall be prepared by 

the Executive Secretary and submitted to the representatives fox 
review no later than ten calendar days following the meeting. 

shall, as a minimum, describe and record the vote on 
each decision made in the meeting. 

7. Minutes, summaries, or reports, as appropriate, of 
sub^rdiU^^^ meetings shall be prepared by the Chair of each 

Copies shall be provided to the Executive 
Secretary of the Committee no later than twenty calendar days 
following each meeting or the final meeting, as appropriate! 

Section VI - Voting 

ll represented organizations shall have one vote each 

the Committee. The Chair shall vote in the 
event of a tie. All issues before the Committee will be 

recommendations and decisions made, by a majority 
® representatives present and voting. Minority or ^ 
dissenting views shall be recorded at the request of anv 
representative. ^ 

Voting may be conducted by mail or telephone, barring 

Chair representative, in which case the ^ 

cnair may call a special meeting to conduct the vote. 

=mKoJ‘ JfP^esentatives who are absent from a meeting may 
ubsequently register, through the Executive Secretarv a formal 
^sition for the record with\he Chair. Such a2uon sha?l no? 
affect the outcome of any formal vote. 
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4. Observers to the Committee shall not be considered in 
determining a quorum and shall not cast votes. 

5. Members or representatives, as appropriate, shall 
neither promise nor cast proxy votes. 

Section VTI — Reporting Procedures 

, 1. The Committee shall submit annually to the Steering 

Group its findings on the threat to and evidence of the 
exploitation of Government, including Government contractor, 
telecommunications and automated information security systems. 

2. The Committee shall, through the Executive Secretary, 
be reponsible for maintaining a National Telecommunications and 
Information Systems Security (NTISS) issuance system for the 
purposes of promulgating policies, issuing directives and 
guidance, and disseminating advisory information. These 
issuances shall be in conformance with Appendix B. 

3. The Committee shall approve the release of sensitive 
technical security, material, information, and techniques to 
foreign governments or international organizations with the 
concurrence of the Director of Central Intelligence for those 
activities which the DCI manages. 

4. The Committee shall develop procedures to identify 
systems which handle sensitive non-government information in 
order to encourage, advise and, where appropriate, assist the 
private section in applying security measures. 

5. The Chair shall forward other decisions, recommen- 
dations, or findings and recorded minority or dissenting views 
as determined by the Committee or as otherwise required by the 
Steering Group. 

6. Committee representatives shall forward, through the 
Executive Secretary within the time specified by the Chair, 
copies of such implementing issuances for their respective 
organizations as may be required by the promulgation of NTISS 
policies, directive, or instructions. 

7. Subordinate body reports and recommendations shall be 
submitted, throught he Executive Secretary, to the Chair for 
appropriate action. The receipt of reports and recommendations 

shall not signify approval. Following receipt by 
the Chair, the reports and recommendations shall be reviewed, 

approved or disapproved, and forwarded, as appropriate. 
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Appendix A 


Rational Teleccxnmunications and Information Systems Security 

Committee Membership 

In accordance with Section 5 of NSDD-145, the National 
Telecommunications and Information Systems Security Committee 
shall comprise representatives of the following organizations; 

Chair 

Assistant Secretary of Defense for Command, 

Control, Communications and Intelligence* 

Representatives 

Assistant to the President for National Security Affairs 

The Secretary of State 
The Secretary of the Treasury 
Director, Office of Management and Budget 
The Attorney General 
The Secretary of Commerce 
The Secretary of Transportation 
The Secretary of Energy 
Director of Central Intelligence 
Chairman, Joint Chiefs of Staff 
Director, National Security Agency 
Administrator, General Services Administration 
Director, Federal Bureau of Investigation 
Director, Federal Emergency Management Agency 
The Chief of Staff, United States Army 
The Chief of Naval Operations 
The Chief of staff. United states Air Force 
Commandant, United States Marine Corps 
Director, Defense Intelligence Agency 
Manager, National Communications System 


♦Also serves as the representative of the Department of Defense. 
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APPENDIX B 

NATIONAL TELECOMMUNICATIONS AND INFORMATION SYTEMS 
SECURITY (NTISS) ISSUANCE SYSTEM 


A National Teleconununi cat ions and Information Systems 
Security (NTISS) issuance system is established for purposes of 
prMulgating objectives and policies, issuing directives and 
guidance, and disseminating advisory information. As a minimum, 
the System shall include: 

1. NTISS Policies: May be issued by the Steering 
Group or the Committee and promulgated by its respective Chair 
subsequent to a favorable vote by the members or represen- 
tatives, as applicable. Policy issuances reflect statements of 
national goals and objectives which are applicable to and 
binding upon the departments and agencies of the government. 
NTISS policies shall be issued in the following series: 

001-009 General - applicable to telecommunications 

security {COMSEC ) , information 
systems security (COMPUSEC) , and 
systems security countermeasures 
(TEMPEST) . 

100-199 COMSEC 
200-299 COMPUSEC 
300-399 TEMPEST 
400-499 Reversed 

2. NTISS Directives: These issuances are directive 
upon departments and agencies of the government and are 
promulgated by the Executive Agent, or the Chair when so 
delegated by the Executive Agent. Directives shall be 
coordinated among the represenatatives. Directives shall be 
numbered as follows: 

500-599 General 

600-699 COMSEC 

700-799 COMPUSEC 

800-899 TEMPEST 

900-999 Administrative 
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HTISS Instructions: These issuances provide 
instructional guidelines and establish technical criteria on 
specific security matters for implementation by Committee 
representatives within their respective organizations. They 
shall be promulgated by the National Manager subsequent to 
CTOrdination with the Committee and are applicable to and 
binding upon deparmtents and agencies of the government. 
Instructions shall include legal, technical, or implementation 
guidelines, restrictions, and procedures that are generally 
applicable to the conduct of telecommunications security and 
automated informations security programs or activities. They 
shall be numbered as follows: 


1000-2999 

3000-4999 

5000-6999 

7000-8999 

9000-9999 


General 

COMSEC 

COMPUSEC 

TEMPEST 

Administrative 


4. NTISS Advisory and Information Memoranda: These 
issuances shall provide advice, assistance, or information of 
general interest to all applicable departments and agencies on 
matters of telecommunications security and automated information 
systems security and shall be issued by the National Manager. 
They shall be numbered as follows: 


GENERAL/1- (YR) 
COMSEC/1- (YR) 
COMPUSEC/1- (YR) 
TEMPEST/1- (YR) 


one-up 

one-up 

one-up 

one-up 


series 

series 

series 

series 


by year 
by year 
by year 
by year 
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NATIONAL TELECOMMUNICATIONS AND INFORMATION SYSTEMS SECURITY COMMITTEE 

CHARTER 
for the 

SUBCOMMITTEE ON AUTOMATED INFORMATION SYSTEMS SECURITY 


The National Policy on Telecommunications and Automated 
Information Systems Security (National Security Decision 
Directive 145) authorizes and directs the establishment, under 
the National Telecommunications and Information Systems Security 
Committee (NTISSC) , of a permanent Subcommittee on Automated 
Information Systems Security (SAISS) . In accordance with the 
policies of NSDD-145 and the Governing Procedures of the NTISSC, 
this Charter specifies the organization, responsibilities, and 
mission of the SAISS. 

Matters under the cognizance of the SAISS and subject to 
the deliberations and actions of the SAISS include automated 
information systems security and other such related areas as may 
be determined by the subcommittee to be appropriate. 

1. The Subcommittee shall be composed of one voting represen- 
tative from each organization of the National Telecommunications 
and Informations Systems Security Committee. One alternate for 
each principal SAISS representative shall be designated to act 
with plenary powers in the absence of the principal. Members, 
alternate members, and observers shall have a TOP SECRET 
clearance. 

2. Departments, Agencies and other government organiza-tions 
committed to expeditious implementation of national automated 
information systems security policy, and which are not repre- 
sented on the NTISSC, may be invited by the Chair, NTISSC to 
participate in SAISS activities. Each such organization may be 
represented on the SAISS by an observer, who shall have all 
rights and privileges of representatives, except the right to 
vote. 

3. The SAISS Chair will be the Director, DoD Computer Security 
Center. The NTISSC Secretariat also will serve as the 
secretariat to the SAISS. 

4. The SAISS representatives should meet at least once per 
quarter each calendar year or more often at the call of the 
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Chair or at the request of a majority of the representatives, but 
not less than two times per year. A tentative agenda for each 
subsequent year shall be established by the Secretariat before 
the end of the last quarter of the current calendar year. 

5. The permanent subcommittee shall have as its procedures the 

following: 

a. The SAISS will reach decisions on matters within its 
cognizance by majority vote. In the event of a deadlock, matters 
will be decided by the Chair. Dissenting views, with supporting 
rationale, may be provided by any representative and brought to 
the attention of the NTISSC Secretariat for referral to the full 
Committee. 

b. Subjects for consideration by the SAISS may be referred 
to it by the NTISSC or by any SAISS representative or observer. 
The Secretariat will at least annually specifically solicit 
issues from the SAISS representatives for the forthcoming year. 

c. The Chair will publish an agenda and summary minutes of 
the SAISS and its working groups which shall be the official 
record of business. The agenda shall be provided 10 working days 
before each meeting and the minutes within 10 working days after 
each meeting. 

d. Such other procedures as may be required to conduct the 
chartered activities of the SAISS may be determined by the Chair 
or the full SAISS membership as appropriate. 

6. The SAISS Subcommittee is empowered to establish such 
temporary working groups, committees or ad hoc bodies as may be 
necessary to accomplish its responsibilities under the provisions 

this Charter. Such bodies will establish their own 
procedures, but be established only for such definite term as the 
Chair so designates. 

7. The SAISS Subcommittee is responsible to the full NTISSC 
membership for, and reports to the NTISSC Chair on: 

a. Developing, formulating and recommending, for approval 
and establishment by the NTISSC, specific operating policies, 
objectives, and priorities, affecting matters under the 
cognizance of the SAISS as may be required to achieve the broad 
automated information systems security policies and objectives 
established by NSDD-145, or such guidance as may be subsequently 
issued by the Systems Security Steering Group. 

b. Developing a program to work with the private sector in 
accordance with NSDD-145. 


2 


Sanitized Copy Approved for Release 2010/05/21 : CIA-RDP97M00248R000500170031-4 


Sanitized Copy Approved for Release 2010/05/21 : CIA-RDP97M00248R000500170031-4 

Providing a forum for the interchange of information 
among NTISSC member organizations, their subordinates and 
representatives, on all aspects of automated information systems 
security. ^ 


. , d. Evaluating annually the status of automated information 
•y«teiis security with respect to established objectives and 
poMcles and submit that evaluation to the Chair, NTISSC. 

I*Wuded in the evaluation will be information on the threat to 
and evidence of exploitation of U.S. Government and government 
contractor automated information systems. 

e. Developing automated information systems security 
guidance for NTISSC to provide to the departments and agencies of 
the government. Guidance as defined herein refers to a policy, 
direction, decision, instruction or advice which concerns 
planning, programming, budgeting, allocating, or applying 
automated information systems security requirements, standards, 

criteria, equipments, applications and resources, both human and 
fiscal. 

Interacting with other permanent or temporary 
subcommittees of the NTISSC as necessary to combine, coordinate 
or advise on the implementation of security or protective 
measures where appropriate. This interaction shall take into 
consideration the differing levels of technology which may 
prevail among or between countermeasures systems. 

g. Providing status reports and identifying actions and 
subjects which require the attention of the NTISSC in support of 
promoting and expediting the implementation of automated 
information security programs throughout the government and, 
insofar as it impacts on the exchange of classified or sensitive 
information between industry, the government, and the private 
sector. 

h. Performing or carrying out other responsibilities 
relating to automated information systems security as mav be 
directed by the NTISSC. 

8. The effective date of this Charter is The 

Charter and activities of the SAISS will be reviewed ’biennially 
by the NTISSC. 
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NATIONAL TELECOMMUNICATIONS AND INFORMATION SYSTEMS SECURITY COMMITTEE 

CHARTER 
for the 

SUBCOMMITTEE ON TELECOMMUNICATIONS SECURITY 


The National Policy on Telecommunications and Automated 
Information Systems Security, (National Security Decision 
Directive 145) authorizes and directs the establishment, under 
the National Telecommunications and Information Systems Security 
Committee (NTISSC) , of a permanent Subcommittee on Telecom- 
munications Security (STS) . In accordance with the policies of 
NSDD-145 and the Governing Procedures of the NTISSC, this Charter 
specifies the organization, responsibilities, and mission of the 
STS. 


Matters under the cognizance of the STS and subject to the 
deliberations and actions of the STS include telecommunications 
technology, secure voice systems, secure record and data systems, 
space and satellite telecommunications systems, weapons and 
strategic defense telecommunications systems, command and control 
telecommunications systems, compromising emanations, and other 
such related areas as may be determined by the Subcommittee to be 
appropriate. The Subcommittee also subsumes the responsibilities 
of the former National Communications Security Committee 
Subcommittee on Compromising Emanations. 


1. The Subcommittee shall be composed of one voting represen- 
tative of each organization of the NTISSC. One alternate for 
each principal STS representative shall be designated to act with 
plenary powers in the absence of the principal. Members, 
alternate members and observers shall have a TOP SECRET 
clearance . 

2. Departments, Agencies and other government organizations 
committed to expeditious implementation of national telecommuni- 
cations security policy, and which are not represented on the 
NTISSC, may be invited by the Chair, NTISSC to participate in STS 
activities. Each such organization may be represented on the STS 
by an observer, who shall have all rights and privileges of 
representatives, except the right to vote. 

3. The Chair of the STS shall be the Assistant Secretary, 
Electronic Systems and Information Technology, Department of the 
Treasury. The NTISSC Secretariat also will serve as the 
secretariat to the STS. 

4. The STS representatives should meet at least once per guarter 
each calendar year or more often at the call of the Chair or at 
the request of a majority of the representatives, but not less 
than two times per year. A tentative agenda for each subsequent 
year shall be established by the STS Secretariat before the end 
of the last quarter of the current calendar year. 
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d. Evaluating annually the status of telecommunications 
systems security with respect to established objectives and 
policies and submit that evaluation to the Chair, NTISSC. 

Included in the evaluation will be information on the threat to 
and evidence of exploitation of U.S. Government and government 
contractor telecommunications systems. 

e. Developing telecommunications systems security guidance 
for NTISSC to provide to the departments and agencies of the 
government. Guidance as defined herein refers to a policy, 
direction, decision, instruction or advice which concerns 
planning, programming, budgeting, allocating, or applying 
telecommunications security requirements, standards, criteria, 
equipments, applications and resources, both human and fiscal. 

f. Interacting with other permanent or temporary sub- 
committees of the NTISSC as necessary to combine, coordinate or 
advise on the implementation of security or protective measures 
where appropriate. This interaction shall take into 
consideration the differing levels of technology which may 
prevail among or between countermeasures systems. 

g. Providing status reports and identifying actions and 
subjects which require the attention of the NTISSC in support of 
promoting and expediting the implementation of telecommuni- 
cations security programs throughout the government and, in so 
far as it impacts on the operations of related communications 
between industry, the government, and the private sector. 

h. Performing or carrying out other responsibilities 
relating to telecommunications security as may be directed by the 
NTISSC. 

8. The effective date of this Charter is The 

Charter and activities of the STS will be reviewed biennially by 
the NTISSC. 
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